Following lost devices' data trail

Summary:Recently, we found out that RailCorp has been auctioning off lost USB keys that hadn't been wiped, for which it's currently under investigation by the NSW Privacy Office. How do other travel organisations handle lost property?

Recently, we found out that RailCorp has been auctioning off lost USB keys that hadn't been wiped, for which it's currently under investigation by the NSW Privacy Office. How do other travel organisations handle lost property?

RailCorp came under fire after Sophos' head of technology Paul Ducklin discovered that the railway doesn't always wipe personal information from items being sold in lost-property auctions, even though it has a "good-faith" policy to erase information on the lost devices that it auctions off.

RailCorp keeps items it finds for 28 days before moving them to its Central Station lost-property office. Several times a year, it auctions off the haul, regardless of its value. At its most recent September auction, it sold off about 2100 mobile phones, 110 iPods, 75 cameras, an undisclosed number of laptops and even complete computer towers.

But what about other companies? ZDNet Australia questioned Qantas, Virgin and Greyhound to follow the data trail.

However, when ZDNet Australia recently contacted the airline, it had either changed its tune or been misrepresented. It says that it currently keeps unclaimed lost property for between one and three months, with higher-value items, such as iPods, laptops, electronic games and mobiles phones, kept for three full months. It also goes out of its way to attempt to reunite lost items with their owners.

While low-value items, such as books and clothing, are donated to charities, the company explicitly stated that high-value items, including electronic devices, are not. They are also never auctioned off. But the company also declined to state what happens to unclaimed electronic devices and the information contained on them.

It declined to comment on whether the devices were ever inspected or their contents erased, but ZDNet Australia understands that they are not handed over to the police.

Virgin Australia follows similar procedures, but only keeps high-value items for 30 days. The details of lost property are maintained in a register of information, which is audited every week.

Items held beyond 30 days are donated to charity at the end of the month, but only if they do not contain personal information. If personal information on the device can be removed (such as a removable memory card from a camera), or confidently erased, it can be donated to charity; otherwise, the device is destroyed. The only exception to this rule is laptops, which the airline hands over to police.

Greyhound said that it doesn't receive that many items of lost property on its coaches, averaging about six mobile phones per month, but it holds all items in a secure lock-up area for three months. The company said that the majority of items are usually quickly reunited with their owners within the three-month period.

After this, unclaimed electronic devices are handed over to Australia Post, but not before Greyhound erases any information on the devices. Australia Post then assists in recycling the devices.